- MetaMask has started exiting the Ethereum validators it runs on Lido as a precaution.
- The firm says there is no immediate threat to user wallets or funds, but the unwound ETH could take up to 45 days to return.
- MetaMask became an independent company on September 9.
MetaMask has reiterated that it has not found any indications that user wallets and customer funds faced any imminent threats in its latest security update, confirming that it is still focusing on “containment and verification” steps.
In the meantime, MetaMask continued the precautionary removal of its Ethereum validators from the Lido staking protocol.
Metamask: No immediate threat to wallets
While the follow-up update did not go into detail about the security incident, MetaMask insisted that it had not seen any indication that customer funds had been accessed, based on its investigations up to October 1.
MetaMask’s staking is non-custodial, so it does not hold any withdrawal keys for the staking it runs on behalf of clients.
In the meantime, MetaMask Staking (formerly Consensys Staking), which operates validators inside the largest Ethereum liquid staking protocol, Lido, has been pulling its validators offline.
Lido did not specify the exploit either. However, a governance forum post assured stETH holders that no action was required on their part.
Affected validators are already on the exit queue, with the last expected to be out, though not fully withdrawn, by the end of October 7. Returning those withdrawn Ethereum into validator positions will take at least another 27 days and 18 hours, per the Ethereum validator queue.
A first stress test for a newly independent MetaMask
MetaMask is barely three weeks removed from becoming a September 9 announcement confirming the split into the consumer wallet business, MetaMask, and the protocols and institutional arm, Consensys.
Cryptopolitan reported at the time that the separation is set to finalize by year’s end.
MetaMask has positioned itself as the world’s largest self-custodial financial platform, downloaded more than 100 million times in about 190 countries and trillions of dollars in cumulative transaction volume.
In September 2025, staking platform Kiln also went through its own “orderly exit” from Ethereum validators after an API it provided was exploited in the roughly $40 million SwissBorg breach.
Like MetaMask now, Kiln also insisted that client assets were secure.
MetaMask has not said whether the validators it runs outside Lido are caught up in the current incident, and neither it nor Lido has detailed the nature of the compromise. The company says it will share more verified information as it becomes available.
In the meantime, MetaMask reminded users not to share their Secret Recovery Phrase or private keys with anyone, and urged caution not to go along with any communications that did not come directly from its official channels.
If you're reading this, you’re already ahead. Stay there with our newsletter.
FAQs
Are MetaMask user funds at risk?
MetaMask says it has found no immediate threat to MetaMask wallets and no indication that customer funds have been affected, based on its investigation so far. It stressed that its staking operations are non-custodial and that it does not manage withdrawal keys on behalf of clients.
Why is MetaMask exiting its validators on Lido?
The company is pulling the Ethereum validators it operates inside Lido as a precautionary step while it investigates a compromise affecting part of its infrastructure, according to Lido's security notice reported by Decrypt. Lido warned the move will likely cost foregone rewards and possibly downtime penalties.
How long will the staked ETH take to come back?
ETH being withdrawn could take up to 45 days to return, and that the last affected validators are expected to have exited, though not fully withdrawn, by the end of October 7.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
